does npm cheat and whitelist sunos by default?